Give this a try (index=asset_index sourcetype=asset_sourcetype) | fields asset_id, solution_id, vulnerability_id | join type=left solution_id [search index=solution_index sourcetype=solution_sourcetype | fields solution_id, solution_summary] | join type=left vulnerability_id [search index=vulnerability_index sourcetype=vulnerability_sourcetype | fields vulnerability_id, title, severity | rename title as vulnerability_title] | table asset_id solution_summary vulnerability_title severity ... View more

Check datamodel definition to see the data type for the field Latency whether it's a number or string. Avg works with numbers. ... View more

Are you deploying these filter configurations to your Heavy forwarders/indexers (whichever is the Splunk Enterprise/Cloud instance that comes first in the data flow)? (and restarted Splunk) ... View more

The stats command will summarize  and reduce the result to just the 'lambda' field, so your subsequent timechart will not work.  You want to keep the output of previous command along with your lambda calculations, so use eventstats instead. (https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Eventstats) Try something like this   | tstats count where index=dns groupby _time span=1h | eval time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eventstats avg(count) as lambda | eval alpha=0.01 | eval lower=lambda/(2*n) | eval upper=lambda/(2*(1-alpha))     ... View more

Give this a try \|(?<data>\d+) ... View more

    Assuming the format of "path" including location of segments is static, you can extract each segment as separate field, like this   your current search which fetch field path | rex field=path "\/(?<env>[^\/]+)\/site\/(?<country>[^\/]+)\/(?<status>[^\/]+)"     And then run your aggregation per your requirement your current search which fetch field path | rex field=path "\/(?<env>[^\/]+)\/site\/(?<country>[^\/]+)\/(?<status>[^\/]+)" | stats count by env country status | where country="usa" AND env="dev" AND status="active" | sort 5 -count ... View more

Splunkbase has a great app for updating lookup table from UI. https://splunkbase.splunk.com/app/1724 This uses REST APIs I believe so updates do not require refresh/restart. Check that app out. ... View more

If the field names are static, you can use eventstats to calculate average of those specific fields like this Your current search generating those columns | eventstats avg("Q1_score PREPAID") as "Avg Q1_score PREPAID" ,avg("Q2_score PREPAID") as "Avg Q2_score PREPAID",avg("Q1_score CONSUMER") as "Avg Q1_score CONSUMER" ... View more

This post will get you started: https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Enterprise/td-p/408003 ... View more

I would assume that 'host' field in the Splunk is matching your forwarder server name. To find out which hosts are not sending data for a particular index, you'd need a lookup (or list ) of all hosts that are expected to send data to an index, then you can cross compare the list/lookup with hosts that are actually sending data.  Something like this | tstats count where index=yourIndexName by host | append [| inputlookup yourhostlist.csv | table host | eval count=0] | stats max(count) as count by host | where count=0   If you can't create a lookup and have smaller list of hosts, you could do something like this   | tstats count where index=yourIndexName by host | append [| makeresults| eval host=split("host1 host2 .. list all your hosts space seperated" | table host | mvexpand host| eval count=0] | stats max(count) as count by host | where count=0 ... View more

Here are the few things you can check: Check if UF is throwing any permission issues while reading the log files (index=_internal host=UF sourcetype=splunkd permission denied.  OR similar search). If you've backend access to the forwarder, you can check the permissions on the file to ensure that splunk user (or user with which Splunk forwarder is running) can access the files. Run btool on UF to ensure correct inputs.conf is present ($SPLUNK_HOME/bin/splunk btool inputs list --debug | grep -v system/default) Run Splunk CLI command to check currently monitored files. ($SPLUNK_HOME/bin/splunk list monitor) ... View more

Could you please provide some examples of data in Splunk that you're exporting that is having issues? ... View more

The configuration file precedence is described in following Splunk documentation: https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Wheretofindtheconfigurationfiles  For outputs.conf file, the precedence would be this: $SPLUNK_HOME/etc/system/local/* $SPLUNK_HOME/etc/apps/A/local/* ... $SPLUNK_HOME/etc/apps/z/local/* $SPLUNK_HOME/etc/apps/A/default/* ... $SPLUNK_HOME/etc/apps/z/default/* $SPLUNK_HOME/etc/system/default/*  Based on this, your /opt/splunkforwarder/etc/apps/comp_all_forwarder_outputs/local/outputs.conf version would take precedense. As Richard mentioned, please run btool command (on your UF back end) to see what configurations are taking place. Example btool command: /opt/splunkforwarder/bin/splunk btool outputs list --debug | grep -v system/default ... View more

Did you check the scheduler logs to see if the original alert search is firing and finding results (index=_internal sourcetype=scheduler savedsearch_name="yourOriginalAlertSearchNameHere")? ... View more

I should've been more clear. You would replace "index= _internal" with your search, where you think duplication is happening. (e.g. index=os ) ... View more

Give this a try | timechart count by field_name limit=0 | rename * as orig_* | eventstats avg(orig_*) as avg_* | foreach orig_* [| eval "<<FIELD>>"=round('<<FIELD>>'/'avg_<<MATCHSTR>>')] | fields - avg_* | rename orig_* as * ... View more